LoginSign Up
← Back to all sparks
C

Countly

ANALYTICS
Velocity5.0

Product analytics platform for web and mobile, self-hosted or cloud

countly.com ↗

Countly 25.03.59 defaults to Node 26, supports MongoDB 9 and tightens app scoping.

product-analyticsself-hostedsecurity-patchesaccess controllts
◆Current state
Countly 25.03.59 on November 13 is a large LTS patch. Clean installs and Docker images move to Node.js 26 and MongoDB 9.0, with older versions still working, and arm64 Docker images arrive. Security fixes tighten which apps a scoped token or member can reach across exports, dashboards, alerts and data tools, and wrong two-factor codes now count toward lockout.
◆Where it's heading
Countly is still mostly hardening access control, carrying the token-scoping work from 25.03.58 into every plugin that reads or changes app data. At the same time it keeps the self-hosted stack on current runtimes.
◆Prediction
Expect a 24.05 patch that backports these scoping fixes, as 24.05.55 did after 25.03.58.

◆Recent moves

  1. 16h ago

    Countly 25.03.59: Node 26, MongoDB 9, app scoping fixes

    Moves new installs to Node 26 and MongoDB 9, adds arm64 Docker images, and extends app scoping to exports, dashboards, alerts and data tools. It carries the access-model work from 25.03.58 further across the product.

    View source ↗
  2. 14d ago

    Countly 24.05.55: token rules backported, Node 22 move

    The 24.05 branch gets the token and dashboard permission rules from 25.03.58, as expected, plus a runtime jump that matters more for operators: package installs move to Node 22 and hooks to isolated-vm. It shows the older branch is still patched, but upgrades now take real work.

    View source ↗
  3. 17d ago

    Countly 25.03.58: token scoping, revocation and access fixes

    Unlike the past two upstream-driven patches, this one fixes Countly's own access model: token scoping and revocation, single-use enforcement, per-account login throttling, and stricter rights checks on dashboards, dbviewer and exports. Self-hosters running integrations on app-restricted tokens should check that their tokens still have the permissions they need.

    View source ↗
  4. 19d ago

    Countly 25.03.57-LTS distrusts emSign roots, fixes A/B setup

    A follow-up patch that extends the emSign root distrust to the certifi upgrade script and fixes A/B testing setup on more systems. Installer and certificate maintenance.

    View source ↗
  5. 21d ago

    Countly 25.03.56-LTS: Node CVE patch, licence overdue banner

    Patches the Node.js Brotli CVE in images and existing installs, refreshes Python and certifi, and adds an enterprise payment-overdue banner tied to the licence server. Security upkeep plus another step in License v2 enforcement.

    View source ↗
  6. 1mo ago

    Countly 25.03.55: throttled active-user refresh, explicit DB names

    A small 25.03 patch with operational weight for self-hosters: today's active-user figures are recalculated at most every five minutes instead of on every dashboard load, database names can be set explicitly, and note widgets work again. It continues the pattern of tuning the existing stack rather than adding new analytics surface.

    View source ↗